Re-identification risk prediction
System and method to predict risk of re-identification of a cohort if the cohort is anonymized using a de-identification strategy. An input anonymity histogram and de-identification strategy is used to predict the anonymity histogram that would result from applying the de-identification strategy to the dataset. System embodiments compute a risk of re-identification from the predicted anonymity histogram.
1. A method to predict a risk of re-identification of a de-identified dataset having a plurality of records comprising respective patient information, the method comprising steps of:
generating an anonymity histogram of the dataset;
providing one of a plurality of de-identification strategies that express mitigation techniques of the risk of re-identification to be applied to the dataset;
transforming the anonymity histogram into a predicted histogram under an assumption that the de-identification strategy is applied to the plurality of records of the dataset;
computing a predicted risk of re-identification based on the predicted histogram; and
when the risk of re-identification is higher than a predetermined risk of re-identification:
providing a different one of the plurality of de-identification strategies, and
repeating the steps of transforming and computing until the risk of re-identification is lower than the predetermined risk of re-identification.
2. The method of claim 1 , wherein the plurality of de-identification strategies comprise field generalization, cell suppression and subsampling.
3. The method of claim 2 , further comprising a step of estimating transformation of anonymity of the patient record using the de-identification strategy.
4. The method of claim 1 , wherein the anonymity histogram is computed from the predetermined risk of re-identification.
5. The method of claim 1 , further comprising the step of: applying the one of the plurality of predetermined de-identification strategies when the predicted risk of re-identification is less than the predetermined risk of re-identification, to produce a transformed de-identified dataset.
6. The method of claim 2 , further comprising the step of: using different parameters to search for the de-identification strategy that results in a risk of re-identification below the predetermined risk of re-identification.
7. The method of claim 1 , wherein the step of computing the predicted risk of re-identification comprises steps of computing a public risk of re-identification and computing an acquaintance risk of re-identification.
8. The method of claim 2 , wherein the cell suppression comprises estimating anonymity from an entropy of a quasi-identifier.
9. The method of claim 1 , wherein the anonymity histogram summarizes a risk of re-identification score for the plurality of records and comprises a step of generalizing at least one quasi-identifier.
10. The method of claim 9 , wherein the step of generalizing includes generalizing a range that the at least one quasi-identifier is compared to.
11. The method of claim 1 , wherein the step of transforming the anonymity histogram comprises lowering an entropy associated with a quasi-identifier.
12. A system to predict a risk of re-identification of a de-identified dataset having a plurality of records comprising respective patient information, the method comprising:
a processor configured to:
generate an anonymity histogram of the dataset;
provide one of a plurality of de-identification strategies that express mitigation techniques of the risk of re-identification to be applied to the dataset;
transform the anonymity histogram into a predicted histogram under an assumption that the de-identification strategy is applied to the plurality of records of the dataset;
compute a predicted risk of re-identification based on the predicted histogram; and
when the risk of re-identification is higher than a predetermined risk of re-identification:
provide a different one of the plurality of de-identification strategies, and
repeat the transform and compute acts until the risk of re-identification is lower than the predetermined risk of re-identification.
13. The system of claim 12 , wherein the plurality of de-identification strategies comprise field generalization, cell suppression and subsampling.
14. The system of claim 13 , wherein the processor is further configured to estimate transformation of anonymity of the patient record using the de-identification strategy.
15. The system of claim 12 , wherein the processor is further configured to: use different parameters to search for the de-identification strategy that results in a risk of re-identification below the predetermined risk of re-identification.
16. The system of claim 12 , wherein the predicted risk of re-identification is computed by computing a public risk of re-identification and computing an acquaintance risk of re-identification.
17. The system of claim 13 , wherein cell suppression comprises estimating anonymity from an entropy of a quasi-identifier.